Vulnerability · Published Oct 8, 2026 · Assigned by VulnCheck
CVE-2026-105831EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form
Medium 4.3
In plain English
A medium-severity cross-site scripting in espocrm from espocrm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 81.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record, though Content Security Policy blocks JavaScript execution.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- GitHub Security Advisory (GHSA-xfqv-j65r-qqgh) vendor-advisory
- VulnCheck Advisory: EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form third-party-advisory